[Tracker] Follow-up: extend gate to library-identity-consumer, library-canonical-entity-backfill, six ungated lml-client exports

[jakebromberg]

Follow-up tracker for WXYC/Backend-Service#1280 — the MD-set "Not on Discogs" flag epic. Full design at WXYC/wiki/plans/rotation-discogs-unavailable.md. This is sub-issue 7 (was 6; renumbered after the post-self-review split).

Why this exists

v1 (sub-issues 1a/1b/1c + 2 + 3 + 4 + 5 + 6) gates the runtime-lookup chokepoint (@wxyc/lml-client.lookupMetadata + @wxyc/lml-client.bulkLookupMetadata) plus filters album-level-backfill's candidate query. Three classes of paths remain ungated:

Path	LML access	Why deferred
jobs/library-identity-consumer	direct fetch to /api/v1/identity/bulk-resolve-libraries (BS#802)	library_identity is not catalog hot-read yet (cross-cache-identity substrate still ramping); low cost of false-matched identity rows today
jobs/library-canonical-entity-backfill	direct fetch (per BS CLAUDE.md inventory)	Same: substrate ramp not yet at hot-read
Six @wxyc/lml-client exports not Semaphore-wrapped: getRelease, getArtistDetails, resolveEntity, searchTrackReleases, validateTrackOnRelease, searchLibrary	direct LML calls to PG-cached endpoints	Not on the string-resolve path that produces false matches; per the package comment at shared/lml-client/src/index.ts:79-82, these are deliberately not gated

End state (when this tracker breaks down)

Three sub-tickets, each potentially shippable independently:

1. library-identity-consumer gate

Either migrate the direct fetch through @wxyc/lml-client and inherit a gate there, or add a parallel BS-side gate: candidate selection in jobs/library-identity-consumer/select.ts filters out rows where library.discogs_unavailable = true.

2. library-canonical-entity-backfill gate

Same options: migrate to lml-client or add a candidate-query filter.

3. Six ungated lml-client exports — audit + per-export decision

For each of getRelease, getArtistDetails, resolveEntity, searchTrackReleases, validateTrackOnRelease, searchLibrary:

• Audit the call sites in BS — which paths read the result?
• If any path could render Discogs-derived data for a flagged album, decide whether to gate.
• Most likely outcome: these exports stay ungated (PG-cached, off the resolve-by-string path). Document the decision per export.

When to act on this tracker

Trigger conditions:

• A flagged album shows wrong Discogs-derived data sourced from album_metadata, library_identity, or any of the six ungated paths.
• library_identity becomes a hot read path (cross-cache-identity ramp delivers).
• Any other false-match leak surfaces on a flagged album in production.

Until then this ticket stays open as a known scope gap (plan §13 G3/G4/G5).

Blocked by

Sub-issue 1b (BS#1293) — needs the lml-client signature + the gate pattern to extend from.

References

• Plan §10.2 sub-issue 7 + §13 G3/G4/G5: WXYC/wiki/plans/rotation-discogs-unavailable.md
• shared/lml-client/src/index.ts:79-82 — chokepoint scope description
• BS#800 cross-cache-identity pivot — context